Skip to content

Commit 6b8a1ca

Browse files
JacobBarthelmehJacobBarthelmeh
committed
add Windows cert store use with signing and add example arguments
add Windows cert store test case add windows build link with ncrypt for cert store use make windows cert feature default disabled and simplify macro guard
1 parent 7da9297 commit 6b8a1ca

22 files changed

Lines changed: 3907 additions & 190 deletions

File tree

‎.github/workflows/windows-cert-store-test.yml‎

Lines changed: 2233 additions & 0 deletions
Large diffs are not rendered by default.

‎apps/wolfsshd/configuration.c‎

Lines changed: 135 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -71,15 +71,22 @@ struct WOLFSSHD_CONFIG {
7171
char* hostKeyFile;
7272
char* hostCertFile;
7373
char* userCAKeysFile;
74+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
75+
char* hostKeyStore;
76+
char* hostKeyStoreSubject;
77+
char* hostKeyStoreFlags;
78+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
7479
char* hostKeyAlgos;
7580
char* kekAlgos;
7681
char* listenAddress;
7782
char* authKeysFile;
7883
char* forceCmd;
7984
char* pidFile;
85+
#ifdef USE_WINDOWS_API
8086
char* winUserStores;
8187
char* winUserDwFlags;
8288
char* winUserPvPara;
89+
#endif /* USE_WINDOWS_API */
8390
WOLFSSHD_CONFIG* next; /* next config in list */
8491
long loginTimer;
8592
word16 port;
@@ -364,9 +371,16 @@ void wolfSSHD_ConfigFree(WOLFSSHD_CONFIG* conf)
364371
FreeString(&current->forceCmd, heap);
365372
FreeString(&current->usrAppliesTo, heap);
366373
FreeString(&current->groupAppliesTo, heap);
367-
FreeString(&current->winUserStores, heap);
368-
FreeString(&current->winUserDwFlags, heap);
369-
FreeString(&current->winUserPvPara, heap);
374+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
375+
FreeString(&current->hostKeyStore, heap);
376+
FreeString(&current->hostKeyStoreSubject, heap);
377+
FreeString(&current->hostKeyStoreFlags, heap);
378+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
379+
#ifdef USE_WINDOWS_API
380+
FreeString(&current->winUserStores, heap);
381+
FreeString(&current->winUserDwFlags, heap);
382+
FreeString(&current->winUserPvPara, heap);
383+
#endif /* USE_WINDOWS_API */
370384

371385
WFREE(current, heap, DYNTYPE_SSHD);
372386
current = next;
@@ -393,6 +407,11 @@ enum {
393407
OPT_PROTOCOL = 9,
394408
OPT_LOGIN_GRACE_TIME = 10,
395409
OPT_HOST_KEY = 11,
410+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
411+
OPT_HOST_KEY_STORE = 50,
412+
OPT_HOST_KEY_STORE_SUBJECT = 51,
413+
OPT_HOST_KEY_STORE_FLAGS = 52,
414+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
396415
OPT_PASSWORD_AUTH = 12,
397416
OPT_PORT = 13,
398417
OPT_PERMIT_ROOT = 14,
@@ -409,12 +428,20 @@ enum {
409428
OPT_STRICT_MODES = 25,
410429
OPT_TRUSTED_SYSTEM_CA_KEYS = 26,
411430
OPT_TRUSTED_USER_CA_STORE = 27,
431+
#ifdef USE_WINDOWS_API
412432
OPT_WIN_USER_STORES = 28,
413433
OPT_WIN_USER_DW_FLAGS = 29,
414434
OPT_WIN_USER_PV_PARA = 30
435+
#endif /* USE_WINDOWS_API */
415436
};
416437
enum {
417438
NUM_OPTIONS = 31
439+
#ifdef USE_WINDOWS_API
440+
+ 3
441+
#endif /* USE_WINDOWS_API */
442+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
443+
+ 3
444+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
418445
};
419446

420447
static const CONFIG_OPTION options[NUM_OPTIONS] = {
@@ -429,6 +456,15 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
429456
{OPT_ACCEPT_ENV, "AcceptEnv"},
430457
{OPT_PROTOCOL, "Protocol"},
431458
{OPT_LOGIN_GRACE_TIME, "LoginGraceTime"},
459+
/* The config parser uses strncmp with the option-name length, so longer
460+
* option names that share a common prefix MUST appear before the shorter
461+
* one. HostKeyStoreSubject/HostKeyStoreFlags before HostKeyStore,
462+
* and all HostKeyStore* before HostKey. */
463+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
464+
{OPT_HOST_KEY_STORE_SUBJECT, "HostKeyStoreSubject"},
465+
{OPT_HOST_KEY_STORE_FLAGS, "HostKeyStoreFlags"},
466+
{OPT_HOST_KEY_STORE, "HostKeyStore"},
467+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
432468
{OPT_HOST_KEY, "HostKey"},
433469
{OPT_PASSWORD_AUTH, "PasswordAuthentication"},
434470
{OPT_PUBKEY_AUTH, "PubkeyAuthentication"},
@@ -446,9 +482,11 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
446482
{OPT_STRICT_MODES, "StrictModes"},
447483
{OPT_TRUSTED_SYSTEM_CA_KEYS, "wolfSSH_TrustedSystemCAKeys"},
448484
{OPT_TRUSTED_USER_CA_STORE, "wolfSSH_TrustedUserCaStore"},
485+
#ifdef USE_WINDOWS_API
449486
{OPT_WIN_USER_STORES, "wolfSSH_WinUserStores"},
450487
{OPT_WIN_USER_DW_FLAGS, "wolfSSH_WinUserDwFlags"},
451488
{OPT_WIN_USER_PV_PARA, "wolfSSH_WinUserPvPara"},
489+
#endif /* USE_WINDOWS_API */
452490
};
453491

454492
/* returns WS_SUCCESS on success */
@@ -1294,9 +1332,11 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
12941332
break;
12951333
case OPT_STRICT_MODES:
12961334
ret = HandleStrictModes(*conf, value);
1335+
break;
12971336
case OPT_TRUSTED_USER_CA_STORE:
12981337
ret = wolfSSHD_ConfigSetUserCAStore(*conf, value);
12991338
break;
1339+
#ifdef USE_WINDOWS_API
13001340
case OPT_WIN_USER_STORES:
13011341
ret = wolfSSHD_ConfigSetWinUserStores(*conf, value);
13021342
break;
@@ -1306,6 +1346,26 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
13061346
case OPT_WIN_USER_PV_PARA:
13071347
ret = wolfSSHD_ConfigSetWinUserPvPara(*conf, value);
13081348
break;
1349+
#endif /* USE_WINDOWS_API */
1350+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
1351+
case OPT_HOST_KEY_STORE:
1352+
wolfSSH_Log(WS_LOG_INFO,
1353+
"[SSHD] Parsed HostKeyStore = '%s'", value);
1354+
ret = SetFileString(&(*conf)->hostKeyStore, value, (*conf)->heap);
1355+
break;
1356+
case OPT_HOST_KEY_STORE_SUBJECT:
1357+
wolfSSH_Log(WS_LOG_INFO,
1358+
"[SSHD] Parsed HostKeyStoreSubject = '%s'", value);
1359+
ret = SetFileString(&(*conf)->hostKeyStoreSubject, value,
1360+
(*conf)->heap);
1361+
break;
1362+
case OPT_HOST_KEY_STORE_FLAGS:
1363+
wolfSSH_Log(WS_LOG_INFO,
1364+
"[SSHD] Parsed HostKeyStoreFlags = '%s'", value);
1365+
ret = SetFileString(&(*conf)->hostKeyStoreFlags, value,
1366+
(*conf)->heap);
1367+
break;
1368+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
13091369
default:
13101370
break;
13111371
}
@@ -1724,11 +1784,13 @@ int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value)
17241784
return ret;
17251785
}
17261786

1727-
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf) {
1787+
#ifdef USE_WINDOWS_API
1788+
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf)
1789+
{
17281790
if (conf != NULL) {
17291791
if (conf->winUserStores == NULL) {
17301792
/* If no value was specified, default to CERT_STORE_PROV_SYSTEM */
1731-
CreateString(&conf->winUserStores, "CERT_STORE_PROV_SYSTEM",
1793+
CreateString(&conf->winUserStores, "CERT_STORE_PROV_SYSTEM",
17321794
(int)WSTRLEN("CERT_STORE_PROV_SYSTEM"), conf->heap);
17331795
}
17341796

@@ -1738,24 +1800,32 @@ char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf) {
17381800
return NULL;
17391801
}
17401802

1741-
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value) {
1803+
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value)
1804+
{
17421805
int ret = WS_SUCCESS;
17431806

17441807
if (conf == NULL) {
17451808
ret = WS_BAD_ARGUMENT;
17461809
}
17471810

1748-
ret = CreateString(&conf->winUserStores, value, (int)WSTRLEN(value), conf->heap);
1811+
if (ret == WS_SUCCESS) {
1812+
ret = CreateString(&conf->winUserStores, value,
1813+
(int)WSTRLEN(value), conf->heap);
1814+
}
17491815

17501816
return ret;
17511817
}
17521818

1753-
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf) {
1819+
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf)
1820+
{
17541821
if (conf != NULL) {
17551822
if (conf->winUserDwFlags == NULL) {
1756-
/* If no value was specified, default to CERT_SYSTEM_STORE_CURRENT_USER */
1757-
CreateString(&conf->winUserDwFlags, "CERT_SYSTEM_STORE_CURRENT_USER",
1758-
(int)WSTRLEN("CERT_SYSTEM_STORE_CURRENT_USER"), conf->heap);
1823+
/* If no value was specified, default to
1824+
* CERT_SYSTEM_STORE_CURRENT_USER */
1825+
CreateString(&conf->winUserDwFlags,
1826+
"CERT_SYSTEM_STORE_CURRENT_USER",
1827+
(int)WSTRLEN("CERT_SYSTEM_STORE_CURRENT_USER"),
1828+
conf->heap);
17591829
}
17601830

17611831
return conf->winUserDwFlags;
@@ -1764,23 +1834,29 @@ char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf) {
17641834
return NULL;
17651835
}
17661836

1767-
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value) {
1837+
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value)
1838+
{
17681839
int ret = WS_SUCCESS;
17691840

17701841
if (conf == NULL) {
17711842
ret = WS_BAD_ARGUMENT;
17721843
}
17731844

1774-
ret = CreateString(&conf->winUserDwFlags, value, (int)WSTRLEN(value), conf->heap);
1845+
if (ret == WS_SUCCESS) {
1846+
ret = CreateString(&conf->winUserDwFlags, value,
1847+
(int)WSTRLEN(value), conf->heap);
1848+
}
17751849

17761850
return ret;
17771851
}
17781852

1779-
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf) {
1853+
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf)
1854+
{
17801855
if (conf != NULL) {
17811856
if (conf->winUserPvPara == NULL) {
17821857
/* If no value was specified, default to MY */
1783-
CreateString(&conf->winUserPvPara, "MY", (int)WSTRLEN("MY"), conf->heap);
1858+
CreateString(&conf->winUserPvPara, "MY",
1859+
(int)WSTRLEN("MY"), conf->heap);
17841860
}
17851861

17861862
return conf->winUserPvPara;
@@ -1789,17 +1865,22 @@ char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf) {
17891865
return NULL;
17901866
}
17911867

1792-
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value) {
1868+
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value)
1869+
{
17931870
int ret = WS_SUCCESS;
17941871

17951872
if (conf == NULL) {
17961873
ret = WS_BAD_ARGUMENT;
17971874
}
17981875

1799-
ret = CreateString(&conf->winUserPvPara, value, (int)WSTRLEN(value), conf->heap);
1876+
if (ret == WS_SUCCESS) {
1877+
ret = CreateString(&conf->winUserPvPara, value,
1878+
(int)WSTRLEN(value), conf->heap);
1879+
}
18001880

18011881
return ret;
18021882
}
1883+
#endif /* USE_WINDOWS_API */
18031884

18041885
char* wolfSSHD_ConfigGetUserCAKeysFile(const WOLFSSHD_CONFIG* conf)
18051886
{
@@ -1834,6 +1915,43 @@ static int SetFileString(char** dst, const char* src, void* heap)
18341915
return ret;
18351916
}
18361917

1918+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
1919+
char* wolfSSHD_ConfigGetHostKeyStore(const WOLFSSHD_CONFIG* conf)
1920+
{
1921+
char* ret = NULL;
1922+
1923+
if (conf != NULL) {
1924+
ret = conf->hostKeyStore;
1925+
}
1926+
1927+
return ret;
1928+
}
1929+
1930+
1931+
char* wolfSSHD_ConfigGetHostKeyStoreSubject(const WOLFSSHD_CONFIG* conf)
1932+
{
1933+
char* ret = NULL;
1934+
1935+
if (conf != NULL) {
1936+
ret = conf->hostKeyStoreSubject;
1937+
}
1938+
1939+
return ret;
1940+
}
1941+
1942+
1943+
char* wolfSSHD_ConfigGetHostKeyStoreFlags(const WOLFSSHD_CONFIG* conf)
1944+
{
1945+
char* ret = NULL;
1946+
1947+
if (conf != NULL) {
1948+
ret = conf->hostKeyStoreFlags;
1949+
}
1950+
1951+
return ret;
1952+
}
1953+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
1954+
18371955
int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file)
18381956
{
18391957
int ret = WS_SUCCESS;

‎apps/wolfsshd/configuration.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,16 +51,23 @@ char* wolfSSHD_ConfigGetHostCertFile(const WOLFSSHD_CONFIG* conf);
5151
char* wolfSSHD_ConfigGetUserCAKeysFile(const WOLFSSHD_CONFIG* conf);
5252
int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file);
5353
int wolfSSHD_ConfigSetHostCertFile(WOLFSSHD_CONFIG* conf, const char* file);
54+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
55+
char* wolfSSHD_ConfigGetHostKeyStore(const WOLFSSHD_CONFIG* conf);
56+
char* wolfSSHD_ConfigGetHostKeyStoreSubject(const WOLFSSHD_CONFIG* conf);
57+
char* wolfSSHD_ConfigGetHostKeyStoreFlags(const WOLFSSHD_CONFIG* conf);
58+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
5459
int wolfSSHD_ConfigSetSystemCA(WOLFSSHD_CONFIG* conf, const char* value);
5560
int wolfSSHD_ConfigGetSystemCA(const WOLFSSHD_CONFIG* conf);
5661
int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value);
5762
int wolfSSHD_ConfigGetUserCAStore(const WOLFSSHD_CONFIG* conf);
63+
#ifdef USE_WINDOWS_API
5864
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf);
5965
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value);
6066
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf);
6167
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value);
6268
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf);
6369
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value);
70+
#endif /* USE_WINDOWS_API */
6471
int wolfSSHD_ConfigSetUserCAKeysFile(WOLFSSHD_CONFIG* conf, const char* file);
6572
word16 wolfSSHD_ConfigGetPort(const WOLFSSHD_CONFIG* conf);
6673
char* wolfSSHD_ConfigGetAuthKeysFile(const WOLFSSHD_CONFIG* conf);

0 commit comments

Comments
 (0)